Risky Bulletin: ShinyHunters suspects arrested in US and Jordan

0:03Two shiny hunters suspects arrested in Jordan and the US. Hackers breach TLD registrars to get valid Google certs. Japanese authorities arrest a Qilin ransomware member. And Google suspends its open source bug bounty program after a flood of AI bug reports. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 12th of October, and this podcast episode is brought to you by cloud security company, Prowler. In today's top story, the FBI has arrested a suspected associate of the Shiny Hunters hacking group. Edward Dubrovsky, a Canadian national and cyber security expert, was arrested in Pennsylvania last week.

0:51FBI Director Cash Patel claims he's being charged in relation to last month's hack of the Bureau's systems. In related news, a suspected Shiny Hunters member has been detained in Jordan. Saif Aldin Khada has been identified as Shiny Hunters member Ray and was detained at the request of the FBI. According to Reuters, he's cooperating with the FBI to help locate other members. The FBI has dropped Accenture as a contractor for failing to secure systems breached by the Shiny Hunters group. According to Reuters, the tech consulting company failed to install security patches for the Oracle PeopleSoft platform that was breached by the group last month.

1:34Shiny hunters claim to have stolen data about almost all FBI special agents. In other news, Google has paused new submissions to its open source software Vulnerability Rewards program. The program has been flooded with AI-generated bug reports, most of which are invalid. Google said it will review the program again in the first quarter of next year. A threat actor obtained HTTPS certificates for some Google domains. The attackers obtained the certificates by hijacking the top-level domain spaces for American Samoa, Ghana and Sierra Leone. The threat actor used their access to pass ownership checks and obtain HTTPS certificates for some domains.

2:19Google says the threat actor targeted some of its services as well as other organizations. Anthropic has disabled internet access for its AI testing environments after new incidents of agent misbehavior came to light. Last week, Claude agents filed false homicide tips to a Philadelphia police department. They also filed 20 US visa applications. Anthropic says both incidents had minimal real-world impact. Meanwhile, OpenAI agents edited Wikipedia and attempted to hack a public Wikimedia note-taking tool. The Wikimedia Foundation says the edits never went live and it was able to stop the attack against its Etherpad service.

3:03The organisation says OpenAI agents also scraped its API, causing a huge spike in traffic. Hackers have stolen the data of 8.8 million citizens from Denmark's Central Population Register. The stolen data includes names, addresses and social security numbers of both living and deceased citizens. The hacker claims they breached the database via an account that used the password 123456. A suspected Chinese threat actor used AI tools to break into South Korean banks and financial companies. The attackers used Artex and Claude agents. CrowdStrike has confirmed data was exfiltrated. Traded, South Korean authorities are investigating the intrusions.

3:51Almost 80 Yandex cloud services went down on Sunday after Ukrainian drones struck a major data center near Moscow. The attack in the city of Vladimir was the third strike against Yandex data centers in four days. Cloudflare reported a drop of 50 % in automated bot traffic out of Russia following the strike. Russia also hit data centers in Ukraine this month. Four U.S. Attorneys General have sued TP-Link for misleading customers about the security of its routers and not disclosing its ties to the Chinese government. The lawsuits have been filed by the Attorneys General of Florida, Montana, Iowa and Nebraska.

4:33TP-Link said the lawsuits are baseless. U.S. government agencies are lagging behind in adopting post-quantum cryptography, according to the Government Accountability Office. Of 24 major federal agencies, only one has completed the first step of inventorying its assets. None have reached the second and third phases of allocating funding and testing new PQC algorithms. The Government Accountability Office cited the lack of expertise as a main reason for the delays. Japanese police arrested a Russian national believed to be a key member of the Qilin ransomware group. The man's been extradited to Germany to face charges over an attack on a German company.

5:18The Chilin Group is currently the most active ransomware operation. The FBI has arrested the alleged developer of the Plotus ATM jackpotting malware. Annibel Alexander-Kernelon Aguirre was arraigned in a New York court in early October. The Plotus malware can force ATMs to eject all their cash. The U.S. Department of Justice has charged the owner of cybersecurity firm Monster Cloud with fraud. Zohar Pinhasi offered a ransomware recovery service that purported to recover victims' files via technical means. In reality, he was just paying the ransomware actors to recover the files. Pinhasi's firm allegedly paid ransomware groups$8 million and charged customers$19 million.

6:08Police in Montenegro have arrested the founder of Rybar, a pro-Kremlin Russian military blog and disinformation group. Mikhail Vinchak was arrested on Friday alongside his wife and three other Russian nationals. He was detained, questioned and deported from the country. According to local media, the five were filming a documentary as part of a Russian influence operation. The film was intended to undermine Montenegro's EU integration process. Before Zvinchuk was released, Russian authorities threatened to arrest American and Europeans in retaliation for Zvinchuk. A dual Russian-Ukrainian national has pleaded guilty in the U.S.

6:48to running the money laundering service Your Mule Cash Out. Olog Konyiv recruited more than 15 ,000 money mules in America. They were used to move and launder more than$10 million in illicit money. The DOJ says Kornyev developed the service's policies and procedures, recruited and managed its employees, and secured illegal services that supported the platform. Four other YourMule cash-out members received sentences ranging from three to five years in prison. Kornyev faces up to 50 years behind bars. A Missouri man has been sentenced to more than two and a half years in prison for hacking and extorting his employer.

7:27In late 2023, Daniel Ryan deployed scripts that deleted user accounts and shut down service on the network of his employer, industrial gas producer Mesa North America. Ryan asked for a 20-bitcoin ransom from the company, which was worth$750 ,000 at the time. A North Carolina man has been sentenced to 18 months in prison for defrauding music streaming platforms with AI-generated songs. Michael Smith created hundreds of thousands of songs using AI tools, uploaded them to streaming platforms, and used bot accounts to stream them. He received more than$8 million in royalties from platforms including Apple Music, Spotify, and YouTube.

8:13US and French authorities have seized two domains that hosted child sexual abuse material and non-consensual adult images. The domains were owned by the website Nude Leaks Teens that sold hacked images and videos of young women and girls. French authorities also arrested the site's administrator, a 25-year-old from northern France. Cambodian authorities have raided a cyber scam compound in the city of Poipette. Police arrested 587 people, including the operation's suspected leader, a Thai national. Almost 90 % of the suspects were Indonesian. Indonesian police have detained five suspects who drove an SMS blaster around Jakarta.

8:58The group was allegedly sending 20 ,000 smishing messages a day. Police noticed the car driving very slowly back and forth along a busy metro route. They also found a map of other busy railway and metro stations the group was planning to target. A German court has ruled that a former financial manager of a local company was negligent when he sent scammers more than 50 million euros. In 2024, scammers spoofed the phone number of the company's CEO and tricked the manager into making the transactions. The court says the manager was negligent as he'd received training about these types of scams just weeks earlier.

9:36It was ordered to repay his employer most of the stolen funds, but he's appealing the ruling. Security researchers have identified 17 ,610 GitHub repositories that are infecting users with the smart loader malware. The repos had been available on GitHub for months, but were updated at the beginning of October to point their download buttons to malicious versions. The attackers exploited a technique called repointing, where they delete a file from the repo and point its download to an older malicious copy while keeping the current one clean. An unidentified threat actor has leaked the internal chats of the Silent Ransom Group, a well-known data extortion group known to target U.S.

10:22law firms. The leaked chats cover thousands of messages sent between members from August 2025 to September this year. The messages expose plots to send individuals to install malware at law firms, kidnap executives and even spy on military objectives like submarine bases. According to databreaches.net, the files appear to have been taken from a misconfigured MongoDB database. Blockchain analysis firm Chainalysis confirmed the authenticity of the leaks through transactions mentioned in the messages. Anthropic has expanded a program that grants security professionals access to its most powerful AI models.

11:04The company has introduced three new tiers to the Cyber Verification Program. The tiers are based on the nature of the work, such as cyber defense, red team operations, and teams working with critical systems. Bitdefender has found malware in the firmware of some low-cost Android smartphones built on MediaTek hardware. The Midnight Mimosa malware can run code on the device, install other apps, and carry out ad-and-click fraud. Most of the infected devices are forgeries of better-known phone brands. U.S. authorities have seized seven domains used by Flax Typhoon, a Chinese espionage group. The domains hosted command and control servers for vulnerability scanning and phishing operations.

11:48They were owned by Chinese IT firm Integrity Technology Group, a cyber contractor for the Chinese government. Meanwhile, the US is offering a$10 million reward for information on a member of the Chinese cyber espionage group, Hafnium. The Department of Justice charged Zheng Yu in April this year with stealing information on COVID vaccines from US organisations. He was indicted alongside another Chinese national, Xu Ziwei. Xu was arrested and extradited from Italy earlier this year. Atlassian has released security updates to patch an actively exploited zero day in the company's so-called data center product.

12:32Data center is a software suite for self-hosting Atlassian products like Confluence, Jira and Bitbucket. All data center versions are affected. The zero day allows attackers to access files within the web application root directory. Threat actors are exploiting two zero days in RSA CBS cloud backup servers. The attacks target the RSA management console. The zero days are chained together to bypass authentication and run code on the console. Security firm Huntress discovered the attacks last week. There are no patches available for the bugs. IBM and Red Hat have found, reported and patched more than 400 vulnerabilities in popular Java libraries.

13:16The bugs were patched as part of IBM's Project Lightwell, announced in May. A vulnerability in the GoBalance load balancer can allow hackers to retrieve the private keys of Onion dark web services. The vulnerability was allegedly used to hack Dread, a Reddit-like community on the dark web. GoBalance is widely used by dark web services to mitigate DDoS attacks. And finally, Google has updated its SEO guidelines and will downrank websites that publish news and articles under fake AI-generated journalist profiles. Google updated its rules after real reporters uncovered a massive operation run under Brown Brothers Media that was buying real news sites and turning them into AI content mills.

14:03The operation ran hundreds of sites and got more than 50 million page views each month. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Prowler. Find them at prowler.com. Thanks for your company.